Privacy

Who this notice covers

Book & Redeem is an Enjoyable Work product for prepaid appointment packages. This notice covers its product pages, agency connections, staff and customer portals, and support. The app is in development; public enrollment is not open. Other Enjoyable products have separate notices.

Your business decides which customers, packages and appointments it manages. We process those records to provide the service to that business. Enjoyable Work also determines how information is used for its own support, account security and service administration. An agency can manage only the businesses it is authorized to represent.

The Enjoyable Work support team is responsible for privacy questions and requests at [email protected].

What we use, and why

• Sign-in and access: your email address, verified business or customer identity, role, sign-in challenges, session records and connection permissions. These let us check who may see or change a record. Email addresses come from you and your business’s connected CRM.
• Packages and appointments: business and customer references, package rules, credits, booking times, calendar and appointment references, attendance and cancellation outcomes. These let us offer eligible times, track balances and manage appointments.
• Payment and subscription references: order and transaction references, amounts, currency, verification or refund status, and app subscription membership. These help us validate credits and app access. App subscription fees and your business’s package sales are separate.
• Connection credentials: access and refresh credentials issued by the connected platform. We store them encrypted for authorized integration operations; they are not exposed in customer pages.
• Security and operations: request time, address and device information handled by hosting services, rate-limit hashes, action references, errors and limited timing information. These help protect access, investigate problems and recover unfinished work.
• Support: your contact information and the details you choose to send. Please send only what is needed to explain the problem.

We do not ask for full payment-card numbers, medical records or other specially regulated information. The app does not use an AI model to process your booking or credit records. We do not sell personal information, use it for targeted advertising, or add behavioral analytics to these pages.

Who receives information

Authorized business staff can access the records allowed by their role. Customers can access their own records. Enjoyable Work support accesses information when needed to operate, support or protect the service.

• HighLevel / LeadConnector: business and customer identity, calendars, appointments, order verification, app installation and subscription information. Your business’s CRM configuration and platform terms also apply.
• Cloudflare: website delivery, API processing, databases and private application storage, background work, security and sign-in email delivery. Email delivery includes the recipient address and one-time code.
• Email providers: your provider receives sign-in messages. Apple iCloud Mail receives incoming mail for our support domain; email providers handle correspondence you send to our team. Do not use ordinary email for sensitive records.
• Payment providers: your business’s selected checkout and payment provider handles package payments; the marketplace handles native app fees. Book & Redeem uses verification references and status, not full card details.

We may disclose information where legally required or necessary to address fraud, security threats or a legal claim. A business transfer involving this service would require appropriate confidentiality protections and any notice or choice required by law. We do not give unrelated customers access to your records.

Cookies and your browser

Sign-in tokens and private page selections stay in memory for the current page session. Signing out clears the app’s private view. A short-lived, secure cookie binds an installation or reconnection to the browser that started it; it does not sign a customer or staff member in.

The website can save a language preference in local storage. Cloudflare may set necessary security cookies or run bot checks. We do not use advertising cookies or analytics identifiers. Your browser, email provider or extensions may keep their own history or copies.

Legal bases and international processing

Where applicable law requires a legal basis, we rely on performing our agreement with the business or responding to your request, legitimate interests in securing and supporting the service, legal obligations, and consent where required. The business is responsible for its basis for collecting and sharing customer information and for giving its customers appropriate notice.

Our providers may process information outside your country. We do not promise that all information stays in Canada, the United States or any other single country. Any required contractual and transfer safeguards depend on the service and applicable law. Contact support for information about the arrangement that applies to your business before sharing data subject to special transfer restrictions.

Retention and protection

We retain information for the purposes explained here, including fulfilling outstanding sessions, preventing duplicate financial effects and resolving disputes. Canceling an app subscription or disconnecting a business does not automatically delete credits or booking history. See our data retention notice for the current limits and request process.

Controls include encrypted connections, scoped access, encrypted integration credentials and checks on financial changes. No system is completely secure. We investigate suspected incidents and give notices to affected parties and authorities when required. These controls are not a claim of certification or approval for regulated data.

Your choices and rights

Depending on applicable law, you may request access, correction, deletion, a portable copy, restriction or objection to processing, or withdraw consent where processing depends on consent. You may also complain to your privacy regulator. These rights can have legal exceptions.

Contact your business first about its customer records, or email [email protected] for help. We verify identity and authority, coordinate business-controlled requests with the business, and explain any applicable limits. We respond within the time required by applicable law. Do not send identity documents unless we arrange a suitable method with you.

Withdrawing connection permissions stops authorized provider operations. It does not itself erase historical records or settle unused package credits. You can use your business’s separate contact channels if you do not want to use the portal.

Children and changes

This service is intended for adult business users and adult customers; it is not directed to children. Businesses must not use it to collect children’s information or specially regulated records without a separately approved arrangement. If such information is submitted, contact support.

We update this notice when the service or its practices change. The date above identifies the version. We will provide additional notice and obtain consent for materially different uses where required. The English text is the current policy text; translated navigation is not a legal translation.